| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | S | 66 | SQL Injection |
| CanFollow | D | 279 | SOAP Manipulation |
| CanPrecede | D | 108 | Command Line Execution through SQL Injection |
Detect Incorrect SOAP Parameter Handling
The attacker tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.
| Technique |
|---|
| The attacker tampers with the SOAP message parameters by injecting some special characters such as single quotes, double quotes, semi columns, etc. The attacker observes system behavior. |
Probe for SQL Injection vulnerability
The attacker injects SQL syntax into vulnerable SOAP parameters identified during the Explore phase to search for unfiltered execution of the SQL syntax in a query.
| Technique |
|---|
Inject SQL via SOAP Parameters
The attacker injects SQL via SOAP parameters identified as vulnerable during Explore phase to launch a first or second order SQL injection attack.
| Technique |
|---|
| An attacker performs a SQL injection attack via the usual methods leveraging SOAP parameters as the injection vector. An attacker has to be careful not to break the XML parser at the service provider which may prevent the payload getting through to the SQL query. The attacker may also look at the WSDL for the web service (if available) to better understand what is expected by the service provider. |
If the attacker is able to gain good understanding of the system's database schema
If the attacker has to perform Blind SQL Injection
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Integrity | N/A | Modify Data | N/A |
| Availability | N/A | Unreliable Execution | N/A |
| Confidentiality | N/A | Read Data | N/A |
| ConfidentialityAccess ControlAuthorization | N/A | Gain Privileges | N/A |
| ConfidentialityIntegrityAvailability | N/A | Execute Unauthorized Commands | Run Arbitrary Code |
| Taxonomy Name | Entry ID | Entry Name |
|---|